test: Postgres with JDBC app (#952)

* test: Postgres with JDBC app

[#186332128](https://www.pivotaltracker.com/story/show/186332128)

* test: force ownership management

it fails:

  STEP: triggering ownership management @ 11/20/23 16:07:20.013
  Running: cf unbind-service app-sprout-myth csb-google-postgres-small-daffodil-koala
  Unbinding app app-sprout-myth from service csb-google-postgres-small-daffodil-koala in org pivotal / space broker-cf-test as admin...
  Job (7ee84c63-f39f-4c20-a1e1-324e4fa990e5) failed: unbind could not be completed: Service broker failed to delete service binding for instance csb-google-postgres-small-daffodil-koala: Service broker error: unbind failed: Error: querying for existing role: error finding role "BWyYQqQcFlVPmpkY": pq: remaining connection slots are reserved for non-replication superuser connections with csbpg_binding_user.new_user, on main.tf line 15, in resource "csbpg_binding_user" "new_user": 15: resource "csbpg_binding_user" "new_user" { exit status 1
  FAILED

[#186332128](https://www.pivotaltracker.com/story/show/186332128)

* test: add label for filtering purposes

[#186332128](https://www.pivotaltracker.com/story/show/186332128)

acceptance-tests/apps/jdbctestapp/manifest-postgres.yml

@@ -0,0 +1,12 @@
+---
+applications:
+- name: jdbctestapp-postgres
+  path: jdbctestapp-postgres-1.0.0.jar
+  buildpacks:
+  - java_buildpack_offline
+  env:
+    JBP_CONFIG_OPEN_JDK_JRE: '{ jre: { version: 17.+ } }'
+    JBP_CONFIG_SPRING_AUTO_RECONFIGURATION: '{ enabled: false }'
+    FLYWAY_POSTGRESQL_TRANSACTIONAL_LOCK: false
+    JAVA_OPTS: '-Djavax.net.ssl.keyStore=/app/META-INF/keystore.jks -Djavax.net.ssl.keyStorePassword=fakepassword'
+    JAVA_KEYSTORE_PASSWORD: 'fakepassword'

acceptance-tests/helpers/apps/testappmanifests.go

@@ -9,6 +9,7 @@ type ManifestCode string
 const (
 	MySQLTLSTestAppManifest       ManifestCode = "jdbctestapp/manifest.yml"
 	MySQLNoAutoTLSTestAppManifest ManifestCode = "jdbctestapp/manifest-no-autotls.yml"
+	PostgresTestAppManifest       ManifestCode = "jdbctestapp/manifest-postgres.yml"
 )
 
 func (a ManifestCode) Path() string {

acceptance-tests/postgresql_test.go

@@ -1,11 +1,12 @@
 package acceptance_test
 
 import (
-	"csbbrokerpakgcp/acceptance-tests/helpers/matchers"
-	"csbbrokerpakgcp/acceptance-tests/helpers/random"
 	"net"
 	"net/url"
 
+	"csbbrokerpakgcp/acceptance-tests/helpers/matchers"
+	"csbbrokerpakgcp/acceptance-tests/helpers/random"
+
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 
@@ -15,6 +16,92 @@ import (
 
 var _ = Describe("PostgreSQL", func() {
 	Describe("Can be accessed by an app", func() {
+		It("work with JDBC and TLS", Label("JDBC", "postgresql"), func() {
+			By("creating a service instance")
+			serviceInstance := services.CreateInstance(
+				"csb-google-postgres",
+				"small",
+				services.WithParameters(map[string]any{"backups_retain_number": 0}),
+			)
+			defer serviceInstance.Delete()
+
+			By("pushing the unstarted app twice")
+			appOne := apps.Push(apps.WithApp(apps.JDBCTestApp), apps.WithTestAppManifest(apps.PostgresTestAppManifest))
+			appTwo := apps.Push(apps.WithApp(apps.JDBCTestApp), apps.WithTestAppManifest(apps.PostgresTestAppManifest))
+			defer apps.Delete(appOne, appTwo)
+
+			type AppResponseUser struct {
+				ID   int    `json:"id"`
+				Name string `json:"name"`
+			}
+
+			type PostgresSSLInfo struct {
+				Pid          int    `json:"pid"`
+				SSL          bool   `json:"ssl"`
+				Version      string `json:"version"`
+				Cipher       string `json:"cipher"`
+				Bits         int    `json:"bits"`
+				ClientDN     string `json:"clientDN"`
+				ClientSerial string `json:"clientSerial"`
+				IssuerDN     string `json:"issuerDN"`
+			}
+			var (
+				userIn, userOut AppResponseUser
+				sslInfo         PostgresSSLInfo
+			)
+
+			By("binding the apps to the service instance")
+			binding := serviceInstance.Bind(appOne)
+
+			By("starting the first app")
+			apps.Start(appOne)
+
+			By("checking that the app environment has a credhub reference for credentials")
+			Expect(binding.Credential()).To(matchers.HaveCredHubRef)
+
+			By("creating an entry using the first app")
+			value := random.Hexadecimal()
+			appOne.POST("", "?name=%s", value).ParseInto(&userIn)
+
+			By("binding and starting the second app")
+			serviceInstance.Bind(appTwo)
+			apps.Start(appTwo)
+
+			By("getting the entry using the second app")
+			appTwo.GET("%d", userIn.ID).ParseInto(&userOut)
+			Expect(userOut.Name).To(Equal(value), "The first app stored [%s] as the value, the second app retrieved [%s]", value, userOut.Name)
+
+			By("verifying the DB connection utilises TLS")
+			appOne.GET("postgres-ssl").ParseInto(&sslInfo)
+			Expect(sslInfo.SSL).To(BeTrue())
+			Expect(sslInfo.Cipher).NotTo(BeEmpty())
+			Expect(sslInfo.Bits).To(BeNumerically(">=", 256))
+
+			By("deleting the entry using the first app")
+			appOne.DELETE("%d", userIn.ID)
+
+			By("triggering ownership management")
+			binding.Unbind()
+
+			By("getting the entry using the second app")
+			appTwo.GET("%d", userIn.ID).ParseInto(&userOut)
+			Expect(userOut.Name).To(Equal(value), "The first app stored [%s] as the value, the second app retrieved [%s]", value, userOut.Name)
+
+			By("setting another value using the second app")
+			var userInTwo AppResponseUser
+			value2 := random.Hexadecimal()
+			appOne.POST("", "?name=%s", value2).ParseInto(&userInTwo)
+
+			By("getting the entry using the second app")
+			var userOutTwo AppResponseUser
+			appTwo.GET("%d", userInTwo.ID).ParseInto(&userOutTwo)
+			Expect(userOut.Name).To(Equal(value), "The second app stored [%s] as the value, the second app retrieved [%s]", value, userOut.Name)
+
+			By("deleting the entries using the second app")
+			appOne.DELETE("%d", userIn.ID)
+			appOne.DELETE("%d", userInTwo.ID)
+		})
+
 		It("works with the default postgres version", Label("postgresql"), func() {
 			By("creating a service instance")
 			serviceInstance := services.CreateInstance("csb-google-postgres", "small")